Follow

SSL VPN - How to Create a Net-to-Net Connection

Applies to Platform: UTM 2.4, UTM 2.5, 4i Edge 2.5
Last update: 5 March 2014

This lesson will illustrate the necessary steps to configure a very simple Net-to-Net SSL VPN (OpenVPN) tunnel between two Endian appliances.

Configuration Example

?name=Network_Diagram_-_VPN__Net2Net_.png

The diagram above is a simple illustration of the configuration example covered in this guide. We'll be creating a Net-to-Net connection to allow communication between the two internal Green (LAN) networks of each Endian device.

Enable the VPN Server (Site A)

?name=media_1297122468487.png

From the Endian main menu, select VPN and immediately you will be taken to the SSL VPN (OpenVPN) server configuration page. The first thing to do is to ensure the OpenVPN server is enabled by checking the first box (1).

The next step is to choose whether you want the OpenVPN server to run in bridged mode (i.e. included in the interface bridge) or you want it to run in non-bridged mode with a separate, unique VPN IP pool. The default is to run in bridged mode (2) to the Green zone and this is recommended for most common VPN deployments. If you choose to run in bridged mode (as we are), you may also specify which network zone you want to be bridged to the VPN interface.

The last thing is to set aside a range of IP's within the bridged interface network to be used exclusively by the VPN server (2). Keep in mind that these IP's shouldn't be allocated anywhere else on the Endian device (e.g. DHCP range, Static IP's , etc.). Once you're done, you can click Save and restart to enable the VPN server.

Note

Once the server has restarted you should see a link appear to Download CA certificate and you will need to do this before you setup the client side. Just click the link and a file download window should appear to save the file (*.pem/.cer) to your local machine. Remember where you store this file for future reference.

Create the VPN Account (Site A)

?name=media_1297288624774.png

Select Accounts from the VPN Server Menu and then select Add account button to create a new VPN account

Create the VPN Account Details (Site A)

?name=media_1297288935814.png

The main things to configure for the new Net-to-Net VPN account are the Username and Password (1) and the Networks behind client (2) which identifies the remote VPN network (Site B) that you will be connecting to this VPN server. This field (2) must be in the format of Network/CIDR (as illustrated) and can accept multiple entries one per line.

Once you've completed the necessary fields, click Save to proceed.

Setup the VPN Client Device (Site B)

?name=media_1295285404251.png

On the client device, from the Endian main menu select VPN > OpenVPN client (Gw2Gw). Once there you will click the Add tunnel configuration button to begin the creation of the client VPN account.

Configure the VPN Account (Site B)

?name=media_1297290130244.png

Now we can configure the setting for the VPN client device. The first field, Connection name, is just a generic string to describe this VPN connection. The next field, Connect to (1), is where you will provide the IP address or DNS hostname (vpn.example.com) of the Endian VPN server. Next you need to upload your server certificate (2) that you had downloaded from the VPN server in the first step. Last, you must provide the Username and Password (3) of this VPN account you previously configured.

Since we're setting up a simple connection, we'll leave the Advanced tunnel configuration options as default.

Once you've completed the necessary fields, click Save to proceed and initiate the client VPN connection.

Verify Connection (Site A)

?name=media_1297290693767.png

If all goes well, we should see the Site B remote device show up on Site A under the Connection status and control section of our VPN server. Once the user is connection you can view relevant VPN user information from this screen as well.

Verify Connection (Site B)

?name=media_1297290350306.png

Now we can also verify the client side is connected by confirming the Status changed to "established" which indicates a successful VPN connection.

Test Internal Connectivity

Now you should be able to successfully test all internal access to remote devices (resources) from both sides of the VPN tunnel. Anything from a simple ICMP ping to an RDP session or remote web server should be accessible across the tunnel.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

  • Avatar
    Daniele De Lorenzi

    We need to create a new how-to for the version 2.5 the VPN user creation is slightly different.

  • Avatar
    India Helpdesk

    very helpful..!!

  • Avatar
    Raymond Potgieter

    Will it be possible (with the setup above) for Site B to connect to a file server on Site A and be able to browse file shares over the VPN?

    Site (A) runs a LINUX SAMBA file server, so every user who has an account on the server can access a server folder e.g. The server is called (PDC) and when the user (Raymond) browses the network (local LAN) and navigates to (PDC) he will see the \PDC\raymond folder and he will be allowed to save files on that folder.

    If the user is on Site (B) will he be able to browse site (a’s) \PDC\raymond folder?

    So basically asking if the config above will allow file shares across the VPN or does file shares require additional configurations?